Getting Data In

Exracting a json field data from a log

soumyacharya91
Path Finder

Hi All,

I am trying to extact a JSON field from the log. I can able to get the data by using "spath input" command. Can you help me with this command's configuration in the back end file so that it can automatically do the job.

search query :

index=*|spath input=<JSON field name>

I need to update this search in props.conf / transforms.conf.

Please find more details about it from the sample log below as I can see it's bit confusing.

"Master_field": "value", "Master_field": "{\"field1\":\"***\",\"field2\":\"value2\",\"field3\":\"value3\",\"field4\":\"value4\",\"field5\":\"{value5}\",\"field6\":\"value6\"},"Master_field": "value"}

Here is the raw data I'm getting in the events. Master fields have been parsed successfully. But the sub fields are not able to parse and they are coming under respective master field.

Using spath command in the query I am able to get the exact data but how to implement the same in the back end file to avoid using this command at search time.

Thanks,
Sam

Tags (1)
0 Karma
1 Solution

ravidudala
Explorer

You can try the following in props.conf

[sourcteype]
INDEXED_EXTRACTIONS = json
KV_MODE = none

View solution in original post

ddrillic
Ultra Champion

We had the following thread about this subject at - What are the requirements for a perfect Splunk JSON document?

The following worked for us -

INDEXED_EXTRACTIONS = json
category = Structured
0 Karma

soumyacharya91
Path Finder

Yes, you are absolutely right we can use this to parse and index the JSON data.

0 Karma

jlvix1
Communicator

I think if you have the data in splunk as sourcetype _json or json_no_timestamp you should be ok, see how this turns up in a verbose mode search and there may not be a need to use INDEXED_EXTRACTIONS=json or KV_MODE = none or spath queries.

There are issues when you have data that "contains" JSON, e.g. an exception message etc... That's when problems begin, is this the case.

0 Karma

ravidudala
Explorer

You can try the following in props.conf

[sourcteype]
INDEXED_EXTRACTIONS = json
KV_MODE = none

soumyacharya91
Path Finder

I tried it but still getting the same result.

0 Karma

p_gurav
Champion

Did you try putting KV_MODE=_json OR INDEXED_EXTRACTION = _json?

0 Karma

soumyacharya91
Path Finder

Yes, already tried KV_MODE=JSON but no luck 😞

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...